CVE-2024-50063

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-50063", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-10-21T19:36:19.939Z", "datePublished": "2024-10-21T19:39:51.718Z", "dateUpdated": "2026-11-10T12:33:34.199Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:41:20.424Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Prevent tail call between progs attached to different hooks\n\nbpf progs can be attached to kernel functions, and the attached functions\ncan take different parameters or return different return values. If\nprog attached to one kernel function tail calls prog attached to another\nkernel function, the ctx access or return value verification could be\nbypassed.\n\nFor example, if prog1 is attached to func1 which takes only 1 parameter\nand prog2 is attached to func2 which takes two parameters. Since verifier\nassumes the bpf ctx passed to prog2 is constructed based on func2's\nprototype, verifier allows prog2 to access the second parameter from\nthe bpf ctx passed to it. The problem is that verifier does not prevent\nprog1 from passing its bpf ctx to prog2 via tail call. In this case,\nthe bpf ctx passed to prog2 is constructed from func1 instead of func2,\nthat is, the assumption for ctx access verification is bypassed.\n\nAnother example, if BPF LSM prog1 is attached to hook file_alloc_security,\nand BPF LSM prog2 is attached to hook bpf_lsm_audit_rule_known. Verifier\nknows the return value rules for these two hooks, e.g. it is legal for\nbpf_lsm_audit_rule_known to return positive number 1, and it is illegal\nfor file_alloc_security to return positive number. So verifier allows\nprog2 to return positive number 1, but does not allow prog1 to return\npositive number. The problem is that verifier does not prevent prog1\nfrom calling prog2 via tail call. In this case, prog2's return value 1\nwill be used as the return value for prog1's hook file_alloc_security.\nThat is, the return value rule is bypassed.\n\nThis patch adds restriction for tail call to prevent such bypasses."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerability is reached through the local `bpf()` syscall \u2014 loading two programs, populating a `BPF_MAP_TYPE_PROG_ARRAY` via `bpf_map_update_elem()`, and attaching one to a hook. Per kernel scoring convention BPF bugs are Local; no network or adjacent-network path exists.\nAC:L - Triggering is fully deterministic and entirely attacker-constructed: load prog A on hook X and prog B on hook Y, insert B into the prog array, attach A, then invoke hook X (e.g. any `open()` for `file_permission`/`file_alloc_security`, or any fentry-traced function). There is no race, no dependence on uncontrolled memory layout, and BTF/trampoline/fentry support plus `CONFIG_BPF_LSM` are enabled by default in mainstream distro kernels.\nPR:L - The attacker needs `CAP_BPF`+`CAP_PERFMON`, which were deliberately split out of `CAP_SYS_ADMIN` precisely so BPF tracing could be granted to non-administrative principals \u2014 observability agents, sidecars, and containers routinely hold them without root, and verifier soundness is the stated boundary they rely on. `bpf_token_capable()` further resolves to `ns_capable(token->userns, ...)`, so with a delegating bpffs mount a user-namespace-confined, non-root principal can load TRACING/LSM programs; this is a constrained delegated privilege, not administrative control over the kernel.\nUI:N - The attacker performs every step in its own processes \u2014 load, map update, attach, and trigger. No victim action, mount, or file open by another user is required.\nS:U - Both the flawed component (BPF verifier/prog-array compatibility check) and the impacted component (kernel memory and LSM decisions) are the kernel itself, under one security authority. No VM, IOMMU, or hypervisor boundary is crossed.\nC:H - The callee reads ctx slots the verifier typed from a different hook's prototype, giving out-of-bounds reads of the caller's trampoline frame (traced return value, saved frame pointer \u2014 kernel stack and text disclosure defeating KASLR) and, in the same-arity case, a verifier-trusted `PTR_TO_BTF_ID` of the wrong struct type. Because `PTR_TO_BTF_ID` loads are compiled to fault-safe `BPF_PROBE_MEM`, this is a reliable arbitrary kernel-memory read oracle whose results can be exfiltrated through any BPF map.\nI:H - The forged trusted pointer passes `KF_TRUSTED_ARGS` kfunc checks (`bpf_task_release`, `bpf_sk_release`, `bpf_cgroup_release`), so a refcount field is decremented at an attacker-chosen offset inside an unrelated object \u2014 a use-after-free that is the standard route to an arbitrary kernel write and control-flow hijack. Independently, the return-value bypass lets a BPF LSM hook return a value outside its contract, so `security_file_alloc()` yields `ERR_PTR(1)` that `IS_ERR()` misses and the VFS uses as a `struct file *`, and it also lets access-control verdicts be forged.\nA:H - The companion fix 5d99e198be27 documents that a positive `file_alloc_security` return \"makes kernel panic\" because the filesystem dereferences it as a file pointer \u2014 this CVE re-opens exactly that path through tail calls, from an ordinary `open()`. The type-confused trusted pointer likewise causes oopses and use-after-free crashes when consumed by kfuncs that do not use probe-read semantics."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/linux/bpf.h", "kernel/bpf/core.c"], "versions": [{"version": "f1b9509c2fb0ef4db8d22dac9aef8e856a5d81f6", "lessThan": "d9a807fb7cbfad4328824186e2e4bee28f72169b", "status": "affected", "versionType": "git"}, {"version": "f1b9509c2fb0ef4db8d22dac9aef8e856a5d81f6", "lessThan": "5d5e3b4cbe8ee16b7bf96fd73a421c92a9da3ca1", "status": "affected", "versionType": "git"}, {"version": "f1b9509c2fb0ef4db8d22dac9aef8e856a5d81f6", "lessThan": "88c2a10e6c176c2860cd0659f4c0e9d20b3f64d1", "status": "affected", "versionType": "git"}, {"version": "f1b9509c2fb0ef4db8d22dac9aef8e856a5d81f6", "lessThan": "28ead3eaabc16ecc907cfb71876da028080f6356", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/linux/bpf.h", "kernel/bpf/core.c"], "versions": [{"version": "5.5", "status": "affected"}, {"version": "0", "lessThan": "5.5", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.135", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.57", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.11.4", "lessThanOrEqual": "6.11.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.5", "versionEndExcluding": "6.1.135"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.5", "versionEndExcluding": "6.6.57"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.5", "versionEndExcluding": "6.11.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.5", "versionEndExcluding": "6.12"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/d9a807fb7cbfad4328824186e2e4bee28f72169b"}, {"url": "https://git.kernel.org/stable/c/5d5e3b4cbe8ee16b7bf96fd73a421c92a9da3ca1"}, {"url": "https://git.kernel.org/stable/c/88c2a10e6c176c2860cd0659f4c0e9d20b3f64d1"}, {"url": "https://git.kernel.org/stable/c/28ead3eaabc16ecc907cfb71876da028080f6356"}], "title": "bpf: Prevent tail call between progs attached to different hooks", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-50063", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-10-22T13:22:37.407385Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-22T13:28:41.892Z"}}, {"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T19:31:40.086Z"}}, {"x_adpType": "supplier", "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-11-10T12:33:34.199Z"}, "affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)", "versions": [{"status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)", "versions": [{"status": "affected", "version": "V3.1.7", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)", "versions": [{"status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)", "versions": [{"status": "affected", "version": "V3.1.7", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)", "versions": [{"status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)", "versions": [{"status": "affected", "version": "V3.1.7", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)", "versions": [{"status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)", "versions": [{"status": "affected", "version": "V3.1.7", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)", "versions": [{"status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)", "versions": [{"status": "affected", "version": "V3.1.7", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"}, {"url": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T19:31:40.086Z"}}, {"affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)", "versions": [{"status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)", "versions": [{"status": "affected", "version": "V3.1.7", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)", "versions": [{"status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)", "versions": [{"status": "affected", "version": "V3.1.7", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)", "versions": [{"status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)", "versions": [{"status": "affected", "version": "V3.1.7", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)", "versions": [{"status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)", "versions": [{"status": "affected", "version": "V3.1.7", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)", "versions": [{"status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)", "versions": [{"status": "affected", "version": "V3.1.7", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}], "x_adpType": "supplier", "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"}, {"url": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}], "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-11-10T12:33:34.199Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-50063", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-10-22T13:22:37.407385Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-22T13:22:40.892Z"}}], "cna": {"title": "bpf: Prevent tail call between progs attached to different hooks", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerability is reached through the local `bpf()` syscall \u2014 loading two programs, populating a `BPF_MAP_TYPE_PROG_ARRAY` via `bpf_map_update_elem()`, and attaching one to a hook. Per kernel scoring convention BPF bugs are Local; no network or adjacent-network path exists.\nAC:L - Triggering is fully deterministic and entirely attacker-constructed: load prog A on hook X and prog B on hook Y, insert B into the prog array, attach A, then invoke hook X (e.g. any `open()` for `file_permission`/`file_alloc_security`, or any fentry-traced function). There is no race, no dependence on uncontrolled memory layout, and BTF/trampoline/fentry support plus `CONFIG_BPF_LSM` are enabled by default in mainstream distro kernels.\nPR:L - The attacker needs `CAP_BPF`+`CAP_PERFMON`, which were deliberately split out of `CAP_SYS_ADMIN` precisely so BPF tracing could be granted to non-administrative principals \u2014 observability agents, sidecars, and containers routinely hold them without root, and verifier soundness is the stated boundary they rely on. `bpf_token_capable()` further resolves to `ns_capable(token->userns, ...)`, so with a delegating bpffs mount a user-namespace-confined, non-root principal can load TRACING/LSM programs; this is a constrained delegated privilege, not administrative control over the kernel.\nUI:N - The attacker performs every step in its own processes \u2014 load, map update, attach, and trigger. No victim action, mount, or file open by another user is required.\nS:U - Both the flawed component (BPF verifier/prog-array compatibility check) and the impacted component (kernel memory and LSM decisions) are the kernel itself, under one security authority. No VM, IOMMU, or hypervisor boundary is crossed.\nC:H - The callee reads ctx slots the verifier typed from a different hook's prototype, giving out-of-bounds reads of the caller's trampoline frame (traced return value, saved frame pointer \u2014 kernel stack and text disclosure defeating KASLR) and, in the same-arity case, a verifier-trusted `PTR_TO_BTF_ID` of the wrong struct type. Because `PTR_TO_BTF_ID` loads are compiled to fault-safe `BPF_PROBE_MEM`, this is a reliable arbitrary kernel-memory read oracle whose results can be exfiltrated through any BPF map.\nI:H - The forged trusted pointer passes `KF_TRUSTED_ARGS` kfunc checks (`bpf_task_release`, `bpf_sk_release`, `bpf_cgroup_release`), so a refcount field is decremented at an attacker-chosen offset inside an unrelated object \u2014 a use-after-free that is the standard route to an arbitrary kernel write and control-flow hijack. Independently, the return-value bypass lets a BPF LSM hook return a value outside its contract, so `security_file_alloc()` yields `ERR_PTR(1)` that `IS_ERR()` misses and the VFS uses as a `struct file *`, and it also lets access-control verdicts be forged.\nA:H - The companion fix 5d99e198be27 documents that a positive `file_alloc_security` return \"makes kernel panic\" because the filesystem dereferences it as a file pointer \u2014 this CVE re-opens exactly that path through tail calls, from an ordinary `open()`. The type-confused trusted pointer likewise causes oopses and use-after-free crashes when consumed by kfuncs that do not use probe-read semantics."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "f1b9509c2fb0ef4db8d22dac9aef8e856a5d81f6", "lessThan": "d9a807fb7cbfad4328824186e2e4bee28f72169b", "versionType": "git"}, {"status": "affected", "version": "f1b9509c2fb0ef4db8d22dac9aef8e856a5d81f6", "lessThan": "5d5e3b4cbe8ee16b7bf96fd73a421c92a9da3ca1", "versionType": "git"}, {"status": "affected", "version": "f1b9509c2fb0ef4db8d22dac9aef8e856a5d81f6", "lessThan": "88c2a10e6c176c2860cd0659f4c0e9d20b3f64d1", "versionType": "git"}, {"status": "affected", "version": "f1b9509c2fb0ef4db8d22dac9aef8e856a5d81f6", "lessThan": "28ead3eaabc16ecc907cfb71876da028080f6356", "versionType": "git"}], "programFiles": ["include/linux/bpf.h", "kernel/bpf/core.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.5"}, {"status": "unaffected", "version": "0", "lessThan": "5.5", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.135", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.57", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.11.4", "versionType": "semver", "lessThanOrEqual": "6.11.*"}, {"status": "unaffected", "version": "6.12", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["include/linux/bpf.h", "kernel/bpf/core.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/d9a807fb7cbfad4328824186e2e4bee28f72169b"}, {"url": "https://git.kernel.org/stable/c/5d5e3b4cbe8ee16b7bf96fd73a421c92a9da3ca1"}, {"url": "https://git.kernel.org/stable/c/88c2a10e6c176c2860cd0659f4c0e9d20b3f64d1"}, {"url": "https://git.kernel.org/stable/c/28ead3eaabc16ecc907cfb71876da028080f6356"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Prevent tail call between progs attached to different hooks\n\nbpf progs can be attached to kernel functions, and the attached functions\ncan take different parameters or return different return values. If\nprog attached to one kernel function tail calls prog attached to another\nkernel function, the ctx access or return value verification could be\nbypassed.\n\nFor example, if prog1 is attached to func1 which takes only 1 parameter\nand prog2 is attached to func2 which takes two parameters. Since verifier\nassumes the bpf ctx passed to prog2 is constructed based on func2's\nprototype, verifier allows prog2 to access the second parameter from\nthe bpf ctx passed to it. The problem is that verifier does not prevent\nprog1 from passing its bpf ctx to prog2 via tail call. In this case,\nthe bpf ctx passed to prog2 is constructed from func1 instead of func2,\nthat is, the assumption for ctx access verification is bypassed.\n\nAnother example, if BPF LSM prog1 is attached to hook file_alloc_security,\nand BPF LSM prog2 is attached to hook bpf_lsm_audit_rule_known. Verifier\nknows the return value rules for these two hooks, e.g. it is legal for\nbpf_lsm_audit_rule_known to return positive number 1, and it is illegal\nfor file_alloc_security to return positive number. So verifier allows\nprog2 to return positive number 1, but does not allow prog1 to return\npositive number. The problem is that verifier does not prevent prog1\nfrom calling prog2 via tail call. In this case, prog2's return value 1\nwill be used as the return value for prog1's hook file_alloc_security.\nThat is, the return value rule is bypassed.\n\nThis patch adds restriction for tail call to prevent such bypasses."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.135", "versionStartIncluding": "5.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.57", "versionStartIncluding": "5.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.11.4", "versionStartIncluding": "5.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12", "versionStartIncluding": "5.5"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:41:20.424Z"}}}, "cveMetadata": {"cveId": "CVE-2024-50063", "state": "PUBLISHED", "dateUpdated": "2026-11-10T12:33:34.199Z", "dateReserved": "2024-10-21T19:36:19.939Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-10-21T19:39:51.718Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["include/linux/bpf.h", "kernel/bpf/core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "d9a807fb7cbfad4328824186e2e4bee28f72169b", "status": "affected", "version": "f1b9509c2fb0ef4db8d22dac9aef8e856a5d81f6", "versionType": "git"}, {"lessThan": "5d5e3b4cbe8ee16b7bf96fd73a421c92a9da3ca1", "status": "affected", "version": "f1b9509c2fb0ef4db8d22dac9aef8e856a5d81f6", "versionType": "git"}, {"lessThan": "88c2a10e6c176c2860cd0659f4c0e9d20b3f64d1", "status": "affected", "version": "f1b9509c2fb0ef4db8d22dac9aef8e856a5d81f6", "versionType": "git"}, {"lessThan": "28ead3eaabc16ecc907cfb71876da028080f6356", "status": "affected", "version": "f1b9509c2fb0ef4db8d22dac9aef8e856a5d81f6", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["include/linux/bpf.h", "kernel/bpf/core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.5"}, {"lessThan": "5.5", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.135", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.57", "versionType": "semver"}, {"lessThanOrEqual": "6.11.*", "status": "unaffected", "version": "6.11.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.12", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"affectedData": [{"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.6", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.7", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.6", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.7", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.6", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.7", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.6", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.7", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.6", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.7", "versionType": "custom"}]}], "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "82ECCC22-EA22-4DC0-97D6-F7DAB414D02A", "versionEndExcluding": "6.1.135", "versionStartIncluding": "5.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "05D83DB8-7465-4F88-AFB2-980011992AC1", "versionEndExcluding": "6.6.57", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "AA84D336-CE9A-4535-B901-1AD77EC17C34", "versionEndExcluding": "6.11.4", "versionStartIncluding": "6.7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Prevent tail call between progs attached to different hooks\n\nbpf progs can be attached to kernel functions, and the attached functions\ncan take different parameters or return different return values. If\nprog attached to one kernel function tail calls prog attached to another\nkernel function, the ctx access or return value verification could be\nbypassed.\n\nFor example, if prog1 is attached to func1 which takes only 1 parameter\nand prog2 is attached to func2 which takes two parameters. Since verifier\nassumes the bpf ctx passed to prog2 is constructed based on func2's\nprototype, verifier allows prog2 to access the second parameter from\nthe bpf ctx passed to it. The problem is that verifier does not prevent\nprog1 from passing its bpf ctx to prog2 via tail call. In this case,\nthe bpf ctx passed to prog2 is constructed from func1 instead of func2,\nthat is, the assumption for ctx access verification is bypassed.\n\nAnother example, if BPF LSM prog1 is attached to hook file_alloc_security,\nand BPF LSM prog2 is attached to hook bpf_lsm_audit_rule_known. Verifier\nknows the return value rules for these two hooks, e.g. it is legal for\nbpf_lsm_audit_rule_known to return positive number 1, and it is illegal\nfor file_alloc_security to return positive number. So verifier allows\nprog2 to return positive number 1, but does not allow prog1 to return\npositive number. The problem is that verifier does not prevent prog1\nfrom calling prog2 via tail call. In this case, prog2's return value 1\nwill be used as the return value for prog1's hook file_alloc_security.\nThat is, the return value rule is bypassed.\n\nThis patch adds restriction for tail call to prevent such bypasses."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bpf: Evitar llamada de cola entre programas adjuntos a diferentes ganchos Los programas bpf se pueden adjuntar a funciones del kernel, y las funciones adjuntas pueden tomar diferentes par\u00e1metros o devolver diferentes valores de retorno. Si prog adjunto a una funci\u00f3n del kernel llama de cola a prog adjunto a otra funci\u00f3n del kernel, se podr\u00eda omitir la verificaci\u00f3n del acceso o del valor de retorno de ctx. Por ejemplo, si prog1 est\u00e1 adjunto a func1 que toma solo 1 par\u00e1metro y prog2 est\u00e1 adjunto a func2 que toma dos par\u00e1metros. Dado que el verificador asume que el bpf ctx pasado a prog2 se construye en base al prototipo de func2, el verificador permite a prog2 acceder al segundo par\u00e1metro del bpf ctx que se le pasa. El problema es que el verificador no impide que prog1 pase su bpf ctx a prog2 mediante llamada de cola. En este caso, el bpf ctx pasado a prog2 se construye a partir de func1 en lugar de func2, es decir, se omite la suposici\u00f3n de verificaci\u00f3n de acceso a ctx. Otro ejemplo, si BPF LSM prog1 est\u00e1 conectado al gancho file_alloc_security y BPF LSM prog2 est\u00e1 conectado al gancho bpf_lsm_audit_rule_known. El verificador conoce las reglas de valor de retorno para estos dos ganchos, por ejemplo, es legal que bpf_lsm_audit_rule_known devuelva un n\u00famero positivo 1 y es ilegal que file_alloc_security devuelva un n\u00famero positivo. Por lo tanto, el verificador permite que prog2 devuelva un n\u00famero positivo 1, pero no permite que prog1 devuelva un n\u00famero positivo. El problema es que el verificador no impide que prog1 llame a prog2 a trav\u00e9s de una llamada de cola. En este caso, el valor de retorno 1 de prog2 se utilizar\u00e1 como el valor de retorno para el gancho file_alloc_security de prog1. Es decir, se omite la regla del valor de retorno. Este parche agrega una restricci\u00f3n para la llamada de cola para evitar tales omisiones."}], "id": "CVE-2024-50063", "lastModified": "2026-11-10T13:17:25.087", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-50063", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-10-22T13:22:37.407385Z", "version": "2.0.3"}}]}, "published": "2024-10-21T20:15:18.360", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/28ead3eaabc16ecc907cfb71876da028080f6356"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5d5e3b4cbe8ee16b7bf96fd73a421c92a9da3ca1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/88c2a10e6c176c2860cd0659f4c0e9d20b3f64d1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d9a807fb7cbfad4328824186e2e4bee28f72169b"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: bpf: Prevent tail call between progs attached to different hooks", "id": "2320617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2320617"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.7", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-841", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nbpf: Prevent tail call between progs attached to different hooks\nbpf progs can be attached to kernel functions, and the attached functions\ncan take different parameters or return different return values. If\nprog attached to one kernel function tail calls prog attached to another\nkernel function, the ctx access or return value verification could be\nbypassed.\nFor example, if prog1 is attached to func1 which takes only 1 parameter\nand prog2 is attached to func2 which takes two parameters. Since verifier\nassumes the bpf ctx passed to prog2 is constructed based on func2's\nprototype, verifier allows prog2 to access the second parameter from\nthe bpf ctx passed to it. The problem is that verifier does not prevent\nprog1 from passing its bpf ctx to prog2 via tail call. In this case,\nthe bpf ctx passed to prog2 is constructed from func1 instead of func2,\nthat is, the assumption for ctx access verification is bypassed.\nAnother example, if BPF LSM prog1 is attached to hook file_alloc_security,\nand BPF LSM prog2 is attached to hook bpf_lsm_audit_rule_known. Verifier\nknows the return value rules for these two hooks, e.g. it is legal for\nbpf_lsm_audit_rule_known to return positive number 1, and it is illegal\nfor file_alloc_security to return positive number. So verifier allows\nprog2 to return positive number 1, but does not allow prog1 to return\npositive number. The problem is that verifier does not prevent prog1\nfrom calling prog2 via tail call. In this case, prog2's return value 1\nwill be used as the return value for prog1's hook file_alloc_security.\nThat is, the return value rule is bypassed.\nThis patch adds restriction for tail call to prevent such bypasses."], "name": "CVE-2024-50063", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Will not fix", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Will not fix", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Will not fix", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Will not fix", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-10-21T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-50063\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-50063\nhttps://lore.kernel.org/linux-cve-announce/2024102136-CVE-2024-50063-1a59@gregkh/T"], "statement": "The default Red Hat Enterprise Linux kernel prevents unprivileged users from being able to use eBPF by the kernel.unprivileged_bpf_disabled sysctl. This would require a privileged user with CAP_SYS_ADMIN or root to be able to abuse this flaw reducing its attack space.\nFor the Red Hat Enterprise Linux 9 to confirm the current state, inspect the sysctl with the command:\ncat /proc/sys/kernel/unprivileged_bpf_disabled\nThe setting of 1 would mean that unprivileged users can not use eBPF, mitigating the flaw.", "threat_severity": "Moderate"}

{}